Topic starter
27/08/2026 2:12 pm
TL;DR: Cybernews reported 19,030,305,929 passwords on the dark web, the largest stolen credential stockpile ever found, with most attributed to InfoStealer malware and social engineering, according to Unixi. The finding shows that password-dependent IAM collapses once credentials are exposed, because reuse, short length, and weak complexity make takeover and brute force attacks easier.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “Uh, About Those 19 Billion Stolen Passwords…”.
By the numbers:
- Just 6% of the passwords Cybernews found were unique.
- Four in ten of the passwords were too short, with fewer than 10 characters.
- 27% of the passwords had no special characters or numbers.
Key questions
Q: What should security teams do when stolen passwords are circulating at scale?
A: Treat exposed passwords as an identity assurance failure, not only a credential hygiene issue.
Q: Why do stolen browser passwords remain dangerous after MFA is enabled?
A: Because MFA protects the interactive login step, but stolen browser credentials and session tokens can still enable account takeover if the attacker also captures a valid session or recovery path.
Q: What are the signs that password-based IAM is no longer keeping pace with attacker behaviour?
A: High password reuse, weak composition, frequent reset demand, and account takeover incidents are all signs that the control is failing in practice.
Practitioner guidance
- Prioritise passwordless authentication for high-risk populations Move privileged users, finance teams, administrators, and frequent remote workers toward phishing-resistant authentication where feasible, because those roles are the most valuable targets for stolen-password reuse.
- Reduce password reuse across estates Review where the same password policy, reset flow, or shared authentication pattern is still accepted across multiple applications, and remove duplicate credential paths that make takeover easier.
- Harden recovery and fallback paths Audit password reset, help-desk verification, and account recovery steps so they do not become the easiest route back into an account after password compromise.
Bottom line: The article shows that password-based IAM still breaks down when credentials are stolen, reused, or guessed at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/08/2026 2:12 pm
Password dependency has become a scale problem, not just a policy problem: Once billions of credentials are circulating on the dark web, the question is no longer whether password rules are strong enough on paper. The real issue is that reusable secrets can be harvested faster than governance processes can meaningfully contain them. For identity programmes, that shifts the centre of gravity toward removing passwords from the primary trust path.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: Should organisations replace passwords everywhere with passkeys immediately?
A: No. Organisations should prioritise high-volume, high-friction consumer flows first, then expand where device support and recovery controls are mature. Immediate replacement can create support gaps if the fallback model is weak. A staged rollout lets teams verify assurance, usability, and operational readiness before eliminating passwords more broadly.
👉 Read our full editorial: 19 billion stolen passwords expose the case for passwordless IAM